CVE-2026-110100

Jorani versions prior to 1.0.4 are vulnerable to a missing authorization flaw in the Contracts::import() function. This allows any authenticated user to import "days off" into any contract using an arbitrary URL via a POST request. Consequences include the ability to overwrite non-working-day cal...

CVE-2026-110100

Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import that allows any authenticated user to import days off into any contract from an arbitrary URL. Attackers can submit a contract id and URL via POST to overwrite non-working-day calendars and abuse getheaders an...